Improve Security with this One-Liner
Picture this: You are searching through the backlog for a nice feature to develop and play with. The day looks nice, the sky is clear, and you’re listening to lo-fi on youtube.
That’s when the infamous security team entered the room/slack channel with their usual complaint: We want more security!
We know that security is essential. I am pretty sure you’ve read Project Unicorn and know this quote: “If a developer ever has a choice between working on a feature or security, they should always choose security.”
The worst security issue of your cloud native app is the part you don’t manage: The Base layer in your containerized app.
Palo Alto found that 96% of third-party container applications deployed in cloud infrastructure contain known vulnerabilities. Scary.
What if I told you that you could improve security just by changing the FROM in your Dockerfile?
Wait, don’t run away!
What if I told you that changing the FROM image won’t break all the language frameworks or dependencies?
SUSE has just released a brand new set of lightweight hardened tech-preview container images (SLE BCI) targeted to developers and operators.
Let’s take a look at the security number with Trivy. Trivy scans existing OCI Images or source files and detects Known Security Issues (aka CVE).
Golang: Official Docker Hub vs. SLE Registry
The result is quite Hardcore. Let’s say it’s a no-match:
# trivy image golang | grep Total -B2 golang (debian 11.1) ==================== Total: 307 (UNKNOWN: 1, LOW: 240, MEDIUM: 39, HIGH: 16, CRITICAL: 11) # trivy image registry.suse.com/bci/golang:1.16 | grep Total -B2 registry.suse.com/bci/golang:1.16 (suse linux enterprise server 15.3) ===================================================================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
NodeJS: Official Docker Hub vs. SLE Registry
If you thought golang was a slice of swiss cheese, take a look at node’s official image:
# trivy image node | grep Total -B2 node (debian 11.1) ================== Total: 713 (UNKNOWN: 2, LOW: 497, MEDIUM: 140, HIGH: 59, CRITICAL: 15) -- Node.js (node-pkg) ================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0) # trivy image registry.suse.com/bci/nodejs:14 | grep Total -B2 registry.suse.com/bci/nodejs:14 (suse linux enterprise server 15.3) =================================================================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -- Node.js (node-pkg) ================== Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 6, CRITICAL: 0)
Python: Official Docker Hub vs. SLE Registry
Last but not least, my favorite language: Python. And it’s a shame:
# trivy image python:3.9 | grep Total -B2 python:3.9 (debian 11.1) ======================== Total: 738 (UNKNOWN: 2, LOW: 520, MEDIUM: 142, HIGH: 59, CRITICAL: 15) -- Python (python-pkg) =================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) # trivy image registry.suse.com/bci/python:3.9 | grep Total -B2 registry.suse.com/bci/python:3.9 (suse linux enterprise server 15.3) ==================================================================== Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -- Python (python-pkg) =================== Total: 2 (UNKNOWN: 1, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
Of course, all the SLE BCI images have the development and build tool dedicated to a specific language. Give it a try!
Just replace the FROM line in your Dockerfile with one of the base Images built and maintained by SUSE.
registry.suse.com/bci/nodejs:12 (NodeJS 12)
registry.suse.com/bci/nodejs:14 (NodeJS 14)
registry.suse.com/bci/openjdk:11 (Java 11 runtime only)
registry.suse.com/bci/openjdk-devel:11 (Java 11 development kit + tools)
registry.suse.com/bci/python:3.6 (Python 3.6)
registry.suse.com/bci/python:3.9 (Python 3.9)
registry.suse.com/bci/golang:1.16 (Golang 1.16)
registry.suse.com/suse/dotnet-aspnet:5.0 (.NET 5.0 runtime only)
registry.suse.com/suse/dotnet-aspnet:3.1 (.NET 3.1 runtime only)
registry.suse.com/suse/dotnet-sdk:5.0 (.NET 5.0 development kit)
registry.suse.com/suse/dotnet-sdk:3.1 (.NET 3.1 development kit)